Mobile phones key to e-commerce security

NEWS

RSA Security has launched an authentication product that uses SMS messages to grant access to business Web sites. RSA Mobile is intended to help merchants and customers on the Web trust each other -- without the need for special hardware or software on the end-user's system. "Distributing a key to the user's phone means that the user does not have to install any hardware or software, and the interface is intuitive," said Sarah Kent, business & corporate development manager at RSA Security. The service has been tested by service providers including BT Ignite and Your Communications, and is intended to allow employees to access corporate applications, or end users to access commerce sites. Right now, in both cases, authentication is usually by password or PIN, although two-factor authentication, in which the user has to have some sort of token as well as knowing a password, is considered more secure. The problem is that most tokens, such as smart cards, are expensive to distribute and can be tricky to use. When the user enters a PIN to a site's log-in screen, the system will send an SMS message to the user's mobile phone, giving them a "virtual token", usually an eight-digit number. The user cannot get full access until this is entered, ensuring that they know the PIN and have the phone. The token can also be sent by email. Losing your mobile phone or having it stolen might compromise the system, if a hacker also knew the PIN number. "But if you lose your mobile phone, you cancel it quite quickly," said Kent, pointing out that users are likely to cancel a lost mobile phone more quickly than a dedicated token which they use less often. Your Communications, a telecoms company in the north-east of England, has been piloting the system for eight months, and will offer it as a managed service. "RSA mobile is a third option in our portfolio alongside passwords and SecurID tokens," said Damon Crawford, principal consultant at Your Communications. Around 200 mobile engineers at United Utilities, Your's parent company, are using RSA Mobile to access applications such as job schedules. "The engineers thought tokens were great -- for about a week," said Crawford. "Then they found that key fobs are easy to lose. However, they all have mobile phones, and they are sacrosanct." Also at Your, a prototype application will let United Utilities customers pay their bills online after authenticating with RSA Mobile. Your then plans to offer it as a managed service for financial services companies, insurance companies and other utilities. BT Ignite engineers are also using the product to get jobs and eliminate paper workflow documents, while another prototype BT application gives mortgage advisors access to financial information. The product is being launched worldwide on 4 September, and Kent expects the option to send tokens by email to be more popular in the US, where messages to CDMA phones are sent this way. The product will be available for companies that want to manage their own authentication, as well as to those using a managed service such as that provided by Your. "We are seeing a shift towards managed services with our existing SecurID (hardware token) product," said Kent. Managed authentication services using hardware tokens typically cost between £80 to £100 per user per year, while services based on RSA Mobile will cost "significantly less than that," said Crawford. Users will have to pay for the SMS messages, he pointed out. The product has been integrated with Microsoft's Passport, with the intention of offering a higher level of authentication. The product is compliant with the rival Liberty specifications and will work with Liberty products when they emerge.

More enterprise IT news in ZDNet UK's Tech Update Channel.

For a weekly round-up of the enterprise IT news, sign up for the Tech Update newsletter. Have your say instantly, and see what others have said. Go to the ZDNet news forum. Let the editors know what you think in the Mailroom.

Talkback

If RSA's system is based on SMS it's not going to work very reliably.

I actually proposed a One Time Password system over SMS at an EU sponsored seminar back in 2000 based on some work I had been doing.

Unfortunatly we found that using SMS was not the way, as SMS is regarded as a secondary service to mobile phone companies, they do not gaurenty deleviery at all, let alone timely delivery (ie inside of eight hours).

There are two reasons for this the first is network prioratisation under load (this effect is often seen at New Year etc when the network gets loaded). The real reason however is that the mobile phone system does not know where your phone is at any one time, only where in what cell it was last used.

When a call is placed to you the network makes good effort to connect it. However an SMS will be forwarded on to your last location if you are still there you get it if not the network may or may not make further attempts to deliver it then or at some time in the future depending on loading.

This is why when you get a phone call you often get your SMSs at the same time, or at odd times of day.

via Facebook 21 February, 2006 13:20

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

ike fuelband is great for every healthminded person ! to work out! theres this website called textme4free.com that you can use to text anywhere in...

6 hours ago by bordero on Nike's FuelBand wristband gamifies exercise

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

8 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

12 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

13 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

14 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

16 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

1 day ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

2 days ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

2 days ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint